Krebs identifies a St. Petersburg man as Qilin ransomware admin
Leaked records and forum pivots name 36-year-old Aleksey Yakovtsev; Qilin claims 365 victims in three months.
Stories per day · 30 days
2 RSS
Relatedcritical-infrastructure3safepay3cisa2ransomware2vpn2affiliate-program1ai-agents1attribution1byovd1doxing1extortion1gentlemen1healthcare1identity1manufacturing1qilin1russia1semperis1
26 stories, newest first · one card per story
Stories tagged #double-extortion
Dark Project Ransomware Claims 38 Victims Across 8 Countries
Dark Project ransomware claims 38 victims in eight countries with double-extortion and an 80% affiliate commission.
1
FBI and CISA warn SafePay hit at least 600 organizations
The independent group uses stolen or brute-forced credentials and VPN access, then steals data and appends .SafePay.
2
Gentlemen ransomware disables Defender, deletes backups and spreads
Acronis describes a Go-based RaaS from 2025 that also targets Linux, NAS and BSD, with more than 800 claimed victims.
CISA says SafePay hit at least 600 critical infrastructure organizations
A US, German and UK advisory says the group, active since August 2024, uses double extortion across four regions.
1
CISA: SafePay ransomware hit over 600 critical infrastructure orgs
Since August 2024 the private group has used stolen or brute-forced credentials, VPN access, phishing, and edge-device flaws, then double-extorted victims.
Ransomware extortion gets personal as attackers target employees’ families
Semperis survey finds ransomware crews increasingly threaten employees’ families, with 84% of victims reporting AI-involved attacks.
5
KFC Named in Gentlemen Ransomware Group’s Latest Breach Claim
The Gentlemen ransomware group listed U.S. KFC on its leak site, but the October 2026 claim remains unverified.
3
University of Illinois Chicago affected by ransomware attack on medical school
Booba ransomware hit UIC's College of Medicine, stealing data without disrupting patient care.
2
Risky Bulletin: Authorities dismantle KillSec group, arrest members across Europe
European police dismantled the KillSec ransomware gang, arresting three suspects including a 16-year-old administrator.
5
16-year-old Alleged KillSec Ransomware Group Leader Arrested, Servers Dismantled
Nine-country operation arrests three KillSec ransomware members, including a suspected 16-year-old leader, and seizes five servers plus 110TB of stolen data.
3
From Access to Exfiltration: What Defenders Need to Know
Zscaler ThreatLabz reports ransomware data theft surged 275.8% to 896.2TB, with exfiltration-focused extortion outpacing encryption-centric defenses.
2
Emerging Ransomware Gang Uses Backup Destruction Threats to Pressure Victims
New ransomware gang n0n threatens to destroy backups and has listed more than a dozen victims.
1
New Galago Ransomware Operation Emerges With Links to Panzer Extortion Group
Galago ransomware, linked to Panzer, allegedly stole 105 GB from Icelandic healthcare firm Inter ehf; its leak site is inactive.
The Tale of Two INC Ransom Notes: A Ransomware Timeline | Huntress
Huntress reconstructed an INC ransomware attack hitting 175 endpoints and domain controllers, with two ransom notes dropped 53 minutes apart.
1
New Settra Ransomware Variant Deployed in Attacks on Retail and Manufacturing
Huntress details a new Settra ransomware variant deployed against retail and manufacturing victims since June, using MeshAgent RMM, recovery sabotage, and BYOVD techniques.
1
Ransomware incidents in Japan in the first half of 2026: Investigation of The Gentlemen’s infrastructure and evidence of Qilin's AI use
Cisco Talos reports 90 ransomware incidents hit Japanese organizations in H1 2026, led by The Gentlemen, with Qilin using AI for efficiency.
3
Harley-Davidson Alleged Breach – CL0P Ransomware Adds Motorcycle Maker to the List
CL0P ransomware group listed Harley-Davidson on its extortion leak site, claiming a compromise; the motorcycle maker has not confirmed any breach.
1
Akamai BloghighPLEASE_READ_ME: The Opportunistic Ransomware Devastating MySQL Servers
Guardicore Labs uncovers the PLEASE_READ_ME ransomware campaign targeting MySQL servers, using double extortion and publishing stolen victim data.
Panzer Ransomware Targets Italian Manufacturers and Telecom Firms With ESXi-Ready RaaS
New Panzer ransomware-as-a-service operation lists Italian firms Doimo Cucine and NTE Italia as victims, offering encryptors for Windows, Linux, FreeBSD, and ESXi.
1
Berlin says it won’t pay ransom after hackers steal government data
Berlin refuses ransom as Rhysida ransomware group claims theft of 5.79 TB of government data ahead of September 20 elections.
2
Medusa ransomware gang has hit over 500 organizations, CISA warns
FBI, CISA, and HHS warn Medusa ransomware has hit over 500 organizations across critical infrastructure since June 2021, using phishing and unpatched flaws.
2
More than 200 victims of Medusa ransomware identified over the last year, CISA says
CISA and FBI update Medusa ransomware advisory, reporting more than 500 total victims and warning the gang operationalizes newly disclosed exploits within 24 hours.
3
Researchers Confirm ExfilSquad’s Access to Sensitive Data Across 13 Organizations
Researchers confirmed extortion group ExfilSquad holds stolen sensitive data from at least 13 organizations, publishing leaked datasets via torrents.